Skip to main content
Send your API key as a bearer token on every API request:
The raw key is shown once when it is created. Store it in a secret manager, never in client-side code or a public repository.

​
Environments

Keys are bound to the environment of their project:
  • nsfw_test_... for test projects
  • nsfw_live_... for live projects
The environment prefix must match the key and project record.

​
Scopes

Keys carry explicit scopes:
  • models:read
  • generations:write
  • jobs:read
A request without the required scope returns 403 permission_denied.

​
Rotation and revocation

Revoke a leaked key in the dashboard. Revocation takes effect immediately. When rotating a key, update your secret store before discarding the one-time raw value.
Last modified on September 17, 2026